fix: Cap PARAM_TYPE_GROUP nesting depth in the GCS formatter

format_field() and format_param_group() in the generic-clear-signing
formatter are mutually recursive: a PARAM_TYPE_GROUP entry recurses
through every sub-field, and a nested PARAM_TYPE_GROUP recurses
again. The only existing bound is the per-APDU TLV buffer size,
which still leaves room for a couple hundred nesting levels — enough
to walk through several KB of device stack with a hostile descriptor
on the Nano S+ where total stack is tight.

Thread an explicit `depth` parameter through format_field() and
format_param_group(): the top-level call from cmd_field.c starts at
0, and format_param_group() bumps it before recursing. When depth
reaches MAX_PARAM_GROUP_DEPTH (8), the formatter refuses the
descriptor. Eight nesting levels is well past any realistic GCS
layout and keeps the worst-case stack usage of this code path
bounded.

The unit-test mock for format_field() is updated to match the new
signature, and a regression test asserts that the cap short-circuits
before any sub-field is visited.

(cherry picked from commit 6964b0304fcb9bb5d28840bbbd6b66c829dcc165)